CVE-2026-81719
Received Received - Intake

Arbitrary Code Execution in OpenSSL Encrypt Plugin Handling

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker's plugin, this results in arbitrary code execution with the privileges of the user running openssl_encrypt. Fixed in 1.4.9 by defaulting the signature policy to ENFORCE for non-built-in plugins.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81719
EUVD
EUVD-2026-67069

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the openssl_encrypt function in versions before 1.4.9. It allows untrusted third-party plugins to be executed with insufficient security controls. The default plugin signature policy was set to WARN, meaning unsigned or unverifiable plugins could still be compiled and run in the host process before the sandbox is installed. This could lead to arbitrary code execution with the privileges of the user running openssl_encrypt if an attacker tricks the user into loading a malicious plugin.

Detection Guidance

This vulnerability involves unsigned or unverifiable third-party plugins being executed by openssl_encrypt before version 1.4.9. Detection requires checking the OpenSSL version and plugin signatures. No specific commands are provided in the context.

Impact Analysis

If you use openssl_encrypt in versions before 1.4.9, an attacker could exploit this to run malicious code on your system. This could allow them to take control of your system, steal data, or perform other unauthorized actions, depending on your user privileges.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially resulting in data breaches. Such breaches may violate compliance requirements like GDPR or HIPAA, which mandate strict data protection measures. Failure to address this could result in legal penalties or loss of trust.

Mitigation Strategies

Upgrade to OpenSSL version 1.4.9 or later to enforce plugin signature validation. Avoid loading untrusted plugins until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81719. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart